numando | 3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5

Analysis

Target

3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll
Size

10.0MB
MD5

59431e5b73b362bf13f6cbc8f593f465
SHA1

927fb2c5ac6da16214209d28264d850e7228ed7a
SHA256

3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5
SHA512

cfd086fa39be7be0f725b3998545bdf3d6ff9a012187cc4505ac7f1f79770cfcf01295f93e6e8984f5aece57d4b4cdeaf1545bedcae2ecb9957ca42feb75b72e

Score

10^/10

Detect Numando Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1088-132-0x0000000002590000-0x0000000003A19000-memory.dmp	family_numando
behavioral2/memory/1088-140-0x0000000002590000-0x0000000003A19000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/1088-131-0x0000000002590000-0x0000000003A19000-memory.dmp	vmprotect
behavioral2/memory/1088-132-0x0000000002590000-0x0000000003A19000-memory.dmp	vmprotect
behavioral2/memory/1088-140-0x0000000002590000-0x0000000003A19000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4980 1088 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1088 rundll32.exe
1088 rundll32.exe
1088 rundll32.exe
1088 rundll32.exe

pid	pid_target	process	target process
4980	1088	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1820 wrote to memory of 1088	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1088	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1088	1820	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 696
3⤵
- Program crash
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1088 -ip 1088
1⤵
PID:3284

memory/1088-130-0x0000000000000000-mapping.dmp

Download
memory/1088-131-0x0000000002590000-0x0000000003A19000-memory.dmp

Filesize
20.5MB

Download
memory/1088-132-0x0000000002590000-0x0000000003A19000-memory.dmp

Filesize
20.5MB

Download
memory/1088-133-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1088-134-0x0000000003AA0000-0x0000000003AA1000-memory.dmp

Filesize
4KB

Download
memory/1088-136-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

Filesize
4KB

Download
memory/1088-135-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/1088-137-0x0000000003AE0000-0x0000000003AE1000-memory.dmp

Filesize
4KB

Download
memory/1088-138-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Filesize
4KB

Download
memory/1088-140-0x0000000002590000-0x0000000003A19000-memory.dmp

Filesize
20.5MB

Download